ci: authenticate publish workflows to Cloudsmith via OIDC

[jmeredithg]

What

Migrates all four npm publish/unpublish workflows off registry.npmjs.org and onto our internal Cloudsmith instance (https://cloudsmith.io/gusto/gusto), authenticating via GitHub OIDC instead of a static NPM_TOKEN secret.

Each workflow now:

1. Adds a cloudsmith-io/cloudsmith-cli-action@v2 step (oidc-auth-only: "true") before actions/setup-node, which exchanges the job's GitHub OIDC token for a Cloudsmith token and exports it as CLOUDSMITH_API_KEY in the job env.
2. Points actions/setup-node's registry-url at https://cloudsmith.io/gusto/gusto.
3. Swaps NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} for NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }} on the publish/unpublish step.
4. Adds id-token: write to the job's permissions block (all four jobs already had a permissions block with other entries, which are left untouched).

Files touched

• .github/workflows/publish.yaml
• .github/workflows/publish-rc.yaml
• .github/workflows/unpublish.yaml
• .github/workflows/unpublish-rc.yaml

Precedent

This is the same OIDC auth pattern already merged/open for RubyGems in Gusto/virtuous-pdf#452 and Gusto/fixture_kit#70, adapted here for npm (registry-url + NODE_AUTH_TOKEN instead of a gem credentials file).

Status / caveats

Draft PR. The Cloudsmith npm endpoint format (https://cloudsmith.io/gusto/gusto) has only been confirmed for RubyGems repos so far — it has not been runtime-verified against npm publish/unpublish yet. Holding as draft until a real publish/unpublish run against this workflow confirms the registry URL and auth handshake work for the npm package type. secrets.NPM_TOKEN references have been fully removed from all four files since nothing else in this repo depends on them.

[serikjensen]

@cursoragent could you clean up the PR title here as well as any prettier issues preventing this from passing CI

[cursor]

I've fixed both issues:

Prettier formatting - Fixed formatting in all 4 workflow files and committed the changes:

• .github/workflows/publish-rc.yaml
• .github/workflows/publish.yaml
• .github/workflows/unpublish-rc.yaml
• .github/workflows/unpublish.yaml

PR title - Updated from "Authenticate publish workflow(s) to Cloudsmith via OIDC" to "ci: authenticate publish workflows to Cloudsmith via OIDC" to follow the conventional commit format.

Both CI checks should now pass on the next run.